News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 75 | 20 |
| Today, Tue 27 Oct | 93 so far | 18 |
Developing
Tue 22 Apr 202576 articles
- Marks & Spencer confirms a cyberattack as customers face delayed orders
Marks & Spencer (M&S) has disclosed that it is responding to a cyberattack over the past few days that has impacted operations, including its Click and Collect service. [...]
BleepingComputer - Microsoft Purges Millions of Cloud Tenants in Wake of Storm-0558
The tech giant is boosting Entra ID and MSA security as part of the wide-ranging Secure Future Initiative (SFI) that the company launched following a Chinese APT's breach of its Exchange Online environment in 2023.
Dark Reading - Active! Mail RCE flaw exploited in attacks on Japanese orgs
An Active! Mail zero-day remote code execution vulnerability is actively exploited in attacks on large organizations in Japan. [...]
BleepingComputer - Millions of SK Telecom customers are potentially at risk following USIM data compromise
SK Telecom warned that threat actors accessed customer Universal Subscriber Identity Module (USIM) info through a malware attack. SK Telecom is South Korea’s largest wireless telecom company, a major player in the country’s mobile and tech landscape. It…
Security Affairs - City of Abilene Goes Offline in Wake of Cyberattack
The Texas municipality is following its incident response playbook as it works with a third-party to investigate the scope and scale of the attack.
Dark Reading - 3 More Healthcare Orgs Hit by Ransomware Attacks
Dialysis firm DaVita, Wisconsin-based Bell Ambulance, and Alabama Ophthalmology Associates all suffered apparent or confirmed ransomware attacks this month.
Dark Reading - Hackers abuse Zoom remote control feature for crypto-theft attacks
A hacking group dubbed 'Elusive Comet' targets cryptocurrency users in social engineering attacks that exploit Zoom's remote control feature to trick users into granting them access to their machines. [...]
BleepingComputer - Windows 10 KB5055612 preview update fixes a GPU bug in WSL2
Microsoft has released the optional KB5055612 preview cumulative update for Windows 10 22H2 with two changes, including a fix for a GPU paravirtualization bug in Windows Subsystem for Linux 2 (WSL2). [...]
BleepingComputer - SK Telecom warns customer USIM data exposed in malware attack
South Korea's largest mobile operator, SK Telecom, is warning that a malware infection allowed threat actors to access sensitive USIM-related information for customers. [...]
BleepingComputer - Cyberattack targets thousands of students, staff members at Baltimore City Public Schools
Tolly Taylor reports: A cyberattack by the criminal group known as Cloak on Baltimore City Public Schools stole sensitive personal information of thousands of students and employees, 11 News Investigates has learned. City Schools told 11 News Investigates…
DataBreaches - 'Cookie Bite' Entra ID Attack Exposes Microsoft 365
A proof-of-concept (PoC) attack vector exploits two Azure authentication tokens from within a browser, giving threat actors persistent access to key cloud services, including Microsoft 365 applications.
Dark Reading - Docker Malware Exploits Teneo Web3 Node to Earn Crypto via Fake Heartbeat Signals
Cybersecurity researchers have detailed a malware campaign that's targeting Docker environments with a previously undocumented technique to mine cryptocurrency. The activity cluster, per Darktrace and Cado Security, represents a shift from other…
The Hacker News - Ripple’s recommended XRP library xrpl.js hacked to steal wallets
The recommended Ripple cryptocurrency NPM JavaScript library named "xrpl.js" was compromised to steal XRP wallet seeds and private keys and transfer them to an attacker-controlled server, allowing threat actors to steal all the funds stored in the wallets.…
BleepingComputer - Florida Bar Urges Law Firms to Adopt Incident Response Plans: A Call to Action for Legal Professionals
Joseph J. Lazzarotti of JacksonLewis writes: In late March 2025, the Florida Bar Board of Governors unanimously endorsed the recommendation of its Special Committee on Cybersecurity and Privacy Law that law firms should adopt written incident response plans…
DataBreaches - Hackers Exploit Cloudflare Tunnel Infrastructure to Deploy Multiple Remote Access Trojans
The Sekoia TDR (Threat Detection & Research) team has reported on a sophisticated network infrastructure named “Cloudflare tunnel infrastructure to deliver multiple RATs” being exploited by cyber attackers since at least February 2024. This infrastructure…
gbhackers.com - Threat Research: Collector Stealer C2 Found Leveraging Compromised European Business Subdomains
The Collector Stealer malware, a Russian-origin credential and data theft tool active since mid-2020, seems to still have some C2 beacons that probably are part of a campaign exploiting compromised subdomains of legitimate European businesses. On this report…
badbyte.io - Threat Actors Leverage npm and PyPI with Impersonated Dev Tools for Credential Theft
The Socket Threat Research Team has unearthed a trio of malicious packages, two hosted on the Python Package Index (PyPI) and one on the npm registry, designed to silently pilfer cryptocurrency secrets, including mnemonic seed phrases and private keys.…
gbhackers.com - Cloud Data Security Play Sentra Raises $50 Million Series B
Sentra has now raised north of $100 million for controls technology to keep sensitive data out of misconfigured AI workflows.
SecurityWeek - DataKrypto Launches Homomorphic Encryption Framework to Secure Enterprise AI Models
DataKrypto’s FHEnom for AI combines real-time homomorphic encryption with trusted execution environments to protect enterprise data and models from leakage, exposure, and tampering.
SecurityWeek - Cookie-Bite attack PoC uses Chrome extension to steal session tokens
A proof-of-concept attack called "Cookie-Bite" uses a browser extension to steal browser session cookies from Azure Entra ID to bypass multi-factor authentication (MFA) protections and maintain access to cloud services like Microsoft 365, Outlook, and Teams.…
BleepingComputer - Cyberattack Knocks Texas City’s Systems Offline
The city of Abilene, Texas, is scrambling to restore systems that have been taken offline in response to a cyberattack.
SecurityWeek - Hackers Exploit Legitimate Microsoft Utility to Deliver Malicious DLL Payload
Hackers are now exploiting a legitimate Microsoft utility, mavinject.exe, to inject malicious DLLs into unsuspecting systems. This utility, intended for injecting DLLs in Application Virtualization (App-V) environments, has become a tool of choice for cyber…
gbhackers.com - Cybercriminals Exploit Network Edge Devices to Infiltrate SMBs
Small and midsized businesses (SMBs) continue to be prime targets for cybercriminals, with network edge devices playing a critical role in initial attacks, according to the latest annual threat report by Sophos. The report highlights the persistent threat of…
gbhackers.com - Sophisticated Backdoor Attack Targets ViPNet Networks
In a recent cybersecurity incident, a sophisticated backdoor targeting large organizations in Russia has been uncovered. The affected
SecurityOnline - Criminal IP to Showcase Advanced Threat Intelligence at RSAC™ 2025
Joining Criminal IP at Booth S-634 | South Expo, Moscone Center | April 28 – May 1, 2025 Criminal IP, the global cybersecurity platform specializing in AI-powered threat intelligence and OSINT-based data analytics, will exhibit at RSAC 2025 Conference, held…
gbhackers.com - GCP Cloud Composer Bug Let Attackers Elevate Access via Malicious PyPI Packages
Cybersecurity researchers have detailed a now-patched vulnerability in Google Cloud Platform (GCP) that could have enabled an attacker to elevate their privileges in the Cloud Composer workflow orchestration service that's based on Apache Airflow. "This…
The Hacker News - Criminal IP to Showcase Advanced Threat Intelligence at RSAC™ 2025
Terrance, United States / California, 22nd April 2025, CyberNewsWire
SecurityOnline - DeepSeek Breach Opens Floodgates to Dark Web
The incident should serve as a critical wake-up call. The stakes are simply too high to treat AI security as an afterthought — especially when the Dark Web stands ready to capitalize on every vulnerability.
Dark Reading - All Gmail users at risk from clever replay attack
Cybercriminals are abusing Google’s infrastructure, creating emails that appear to come from Google in order to persuade people into handing over their Google account credentials. This attack, first flagged by Nick Johnson, the lead developer of the Ethereum…
Malwarebytes - TP-Link Router Vulnerabilities Allow Attackers to Execute Malicious SQL Commands
Cybersecurity researchers have uncovered critical SQL injection vulnerabilities in four TP-Link router models, enabling attackers to execute malicious commands, bypass authentication, and potentially hijack devices. The flaws, discovered by researcher The…
gbhackers.com - Faster Vulnerability Patching Reduces Risk and Lowers Cyber Risk Index
Trend Micro’s Cyber Risk Exposure Management (CREM) solution has highlighted the critical role that timely patching plays in reducing an organization’s cyber risk exposure. The report, which scrutinizes the Cyber Risk Index (CRI) a metric quantifying an…
gbhackers.com - Russian organizations targeted by backdoor masquerading as secure networking software updates
As we were looking into a cyberincident in April 2025, we uncovered a rather sophisticated backdoor. It targeted various large organizations in Russia, spanning the government, finance, and industrial sectors. While our investigation into the attack…
securelist.com - Malicious npm Packages Target Linux Developers with SSH Backdoor Attacks
In a sophisticated onslaught targeting the open-source ecosystem, reports have emerged detailing several malicious npm packages that are nefariously exploiting the Telegram Bot API to install backdoors on unsuspecting developers’ Linux systems. This alarming…
gbhackers.com - SSL.com Scrambles to Patch Certificate Issuance Vulnerability
A vulnerability in SSL.com has resulted in nearly a dozen certificates for legitimate domains being wrongly issued.
SecurityWeek - How NDR and Secure Access Service Edge (SASE) Work Together to Achieve Network Security Outcomes
Learn how NDR and SASE solutions complement and interact with each other to create a robust network security strategy.
darktrace.com - Samsung One UI Vulnerability Leaks Sensitive Data in Plain Text With No Expiration!
A glaring vulnerability has come to light within Samsung’s One UI interface: the clipboard history function stores all copied text, including sensitive data like passwords and personal information, in plain text and retains it indefinitely, unless users…
gbhackers.com - Obfuscation Overdrive: Next-Gen Cryptojacking with Layers
Docker is a prime target for malware, with new strains emerging daily. This blog explores a novel campaign showcasing advanced obfuscation and cryptojacking techniques.
darktrace.com - How NDR and ZTNA Work Together to Achieve Network Security Outcomes
Learn how NDR and ZTNA solutions complement and interact with each other to create a robust network security strategy.
darktrace.com - Open Source Security Firm Hopper Emerges From Stealth With $7.6M in Funding
Hopper has emerged from stealth mode with a solution designed to help organizations manage open source software risk.
SecurityWeek - Many Malware Campaigns Linked to Proton66 Network
Security researchers detail various malware campaigns that use bulletproof services linked to Proton66 ASN.
SecurityWeek